Solved

Delete old domain

Posted on 2014-03-19
15
777 Views
Last Modified: 2014-03-28
Hi there, I am in a weird situation.
I had a child domain w2k3 R2 (a.me.com)
it crashed years ago (7 years), we removed it using ntdsutil and he created a new one with se same name.
2 weeks ago, the company merged with another (b.me.com), so I had to get rid off the child domain. I used dcpromo for the a.me.com (which cleared) and now on the AD domains and trusts I can see the a.me.com (old one).
Using the ntdsutil, in metadata I cannot remove the domain, (no site available) with the error:
sRemoveDsDomainW error 0x2015(The directory service can perform the requested operation only on a leaf object.).

Also, in Partition management, I can see: DC=DomainDnsZones,DC=a\0ADEL:bb7cc7ce-96f6-4a98-888c-ed139937e2ed,DC=me,DC=com, and when I try to delete it using "delete nc" I get:
ldap_delete_ext_sW error 0x20(32 (No Such Object).

I now that is a.me.com is the old one because in the ADSIEDIT and LDP.exe  I can see the new a.me.com with different numbers: a\0ADEL:8dbf60e9-3d1d-4b97-8e02-fe3c2186890a,DC=me,DC=com.

The old one is still there and I cannot remove it.

please help
0
Comment
Question by:semltd
  • 9
  • 6
15 Comments
 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
Follow steps in below article to remove child domain
http://support.microsoft.com/kb/887424

Also check below article might be help
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q230306

Mahesh
0
 

Author Comment

by:semltd
Comment Utility
Hello Mahesh,

Thanks for the reply but I have already tried these.

The results are:
On partition management:

partition management: delete nc DC=DomainDnsZones,DC=geri\0ADEL:bb7cc7ce-96f6-4a98-888c-ed139937e2ed,DC=sem,DC=com
ldap_delete_ext_sW error 0x20(32 (No Such Object).
)
partition management: delete nc DC=geri\0ADEL:bb7cc7ce-96f6-4a98-888c-ed139937e2ed,DC=sem,DC=com
ldap_delete_ext_sW error 0x20(32 (No Such Object).
)

and on the metadata:
26 - DC=geri\0ADEL:bb7cc7ce-96f6-4a98-888c-ed139937e2ed,DC=sem,DC=com
select operation target: select domain 26
No current site
Domain - DC=geri\0ADEL:bb7cc7ce-96f6-4a98-888c-ed139937e2ed,DC=sem,DC=com
No current server
No current Naming Context
select operation target: q
metadata cleanup: remove selected domain
DsRemoveDsDomainW error 0x2015(The directory service can perform the requested operation only on a leaf object.)

Beyond that, I searched in ADSIEDIT and could not find the domain anywhere.

Please help!!!
0
 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
0
 

Author Comment

by:semltd
Comment Utility
Hello Mahesh,
this article explains exactly the same thing!!!!

To try removing the DNS zone from partition management from ntdsutil.

see attached file.
error_removing_DNS_zone
This is my problem.
I cannot delete the DNS zone from NTDSUTIL partition management.

Is there  any other way to delete the DNS zone?
0
 

Author Comment

by:semltd
Comment Utility
Is there anyone that can help me?

I believe there might be a solution using lingeringobjects but as far as I could understand, this can clean Domain Controller and not child domains.

I can't see any object that refers to any of the old domain controllers, either in ADSIEDIT not LDP.exe

Plz help!!
0
 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
Are you able to view orphaned domain in the list of domains in ntdsutil ?
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q230306

Also are you running ntdsutil on server holding domain naming master role ?
0
 

Author Comment

by:semltd
Comment Utility
Yes, I can. but I cannot remove it with the following error.
Metadata Errorand when I try to remove the DomainDNSZone and the domain from partition management, I receive the following errors.
PArtition Management error
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
I think you need to use subtree control to delete orphaned domain from active directory
OR you could use some other name for child domain
Check below link for same
http://social.technet.microsoft.com/Forums/en-US/f6d20eeb-104f-49c9-816e-f0f266ce50a3/issues-to-create-child-domain-on-server-2008-r2?forum=windowsserver2008r2general
One more link
http://davehope.co.uk/Blog/removing-a-child-domain-that-no-longer-exists/

Please make some search on how to use subtree control to delete parent object including leaf object
0
 

Author Comment

by:semltd
Comment Utility
Hello Mahesh,

I have managed to clear the lingering objects from all of my domain controllers (18 to be extact, including my child domains), but I think I am doing something wrong.

my error message was:
Source DC (Transport-specific network address):
2fcb78e7-e2ed-409f-8008-5320859b30e3._msdcs.sem.com
Object:
CN=NTDS Settings\0ADEL:dde6432e-7940-4b63-87a1-718f523636a5,CN=GERI-MAINDC2\0ADEL:a7ee08f0-26ce-4882-a13c-04e22bd51a6a,CN=Servers\0ADEL:505884bb-c9b5-4405-b4b7-4807593d3f85,CN=Geri\0ADEL:7b6179ee-8f9d-4b46-a4a4-f05398c9b544,CN=Sites,CN=Configuration,DC=sem,DC=com
Object GUID:
dde6432e-7940-4b63-87a1-718f523636a5
Directory partition:
CN=Configuration,DC=sem,DC=com
Destination highest property USN:
132662975

and the remove lingeringobject I run was:
Repadmin /removeLingeringObjects sem-maindc.sem.com 89769c1e-f4b7-47ce-84bd-00b3d75282bc DC=sem,DC=com

I think my error is: I am running the remove lingeringobject on DC=sem,DC=com,
while my error message indicates that the lingeringobject is located under "N=Sites,CN=Configuration,DC=sem,DC=com"

A little help?
0
 
LVL 35

Accepted Solution

by:
Mahesh earned 500 total points
Comment Utility
Ok in order to clear lingering objects from configuration partition your command must be

repadmin /removelingeringobjects  ServerName ServerGUID DirectoryPartition

Where
ServerName is The DNS name of the domain controller that has or might have lingering objects.
 
ServerGUID
The GUID of a domain controller that has an up-to-date writable replica of the directory partition (Preferably PDC)
 
DirectoryPartition
The distinguished name of the domain directory partition that might have lingering objects. For example, DC=RegionalDomainName,DC=ForestRootDomainName,DC=com
OR
CN=configuration,DC=ForestRootDomainName,DC=com
OR
CN=schema,CN=configuration,DC=ForestRootDomainName,DC=com

Check below article for more clarity
http://technet.microsoft.com/en-us/library/cc785298(v=ws.10).aspx
http://social.technet.microsoft.com/Forums/en-US/61395f6e-3347-4ad4-be32-bb299196d4b7/remove-lingering-objects
http://technet.microsoft.com/en-us/library/cc949134(v=ws.10).aspx

Mahesh
0
 

Author Comment

by:semltd
Comment Utility
So, let me get this right.

The command is:
repadmin /removelingeringobjects
a) <<ServerName>>
b) <<ServerGUID>>
c) <<DirectoryPartition>>

a) <<ServerName>> should be all my Domain Controllers:
sem-maindc.sem.com
DC1.Child-A.sem.com
DC2.Child-A.sem.com
DC1.Child-B.sem.com
DC2.Child-B.sem.com
etc

b) the <<ServerGUID>>  that I have found the error 1988:
in my case sem-maindc2: 89769c1e-f4b7-47ce-84bd-00b3d75282bc DC=sem,DC=com

c) <<DirectoryPartition>>

DC=SEM,DC=com
OR
CN=configuration,DC=SEM,DC=com
OR
CN=schema,CN=configuration,DC=SEM,DC=com

So, if I have 18 domain controller, including the correct one, I have to make copy paste three different commands for each 17 servers:
1) Repadmin /removeLingeringObjects <<a>> <<b>> DC=sem,DC=com
2) Repadmin /removeLingeringObjects <<a>> <<b>> CN=configuration,DC=SEM,DC=com
3) Repadmin /removeLingeringObjects <<a>> <<b>> CN=schema,CN=configuration,DC=SEM,DC=com

17 x 3 = 51

Right?

Because I had an information on one of the servers:
The following object was created on a remote directory service with an object name that already exists on the local directory service.
 
Object:
DC=_gc._tcp.Geri._sites,DC=sem.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=sem,DC=com
Object GUID:
fb2e881e-e1f6-450d-9fbf-9751bc500701
Existing object GUID:
ffe27fe3-d80e-4005-a571-734588f61cd5
 
The object with the following GUID will be renamed since the other object had this name more recently.
 
Object GUID:
fb2e881e-e1f6-450d-9fbf-9751bc500701
Renamed object name:
_gc._tcp.Geri._sites
CNF:fb2e881e-e1f6-450d-9fbf-9751bc500701


Am I correct?
0
 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
That's right

Your server Guid should be your PDC server only every time (PDC is having up to date AD database all the time) OR your all servers that is getting 1988 event
and servername should be all domain controllers
I suggest you to run command again and again until it stop to generate event id 1945 in directory events on affected server (Where lingering objects are found - infact all domain controllers)

Mahesh
0
 

Author Comment

by:semltd
Comment Utility
Hello Mahesh,

I've run this script for lingeringobjects twice.

now on one of the domain controllers, I am receiving these errors:
Error 1800Error 1801
and I am still not able to remove the partition from NTDSUTIL.

Regards
0
 

Author Comment

by:semltd
Comment Utility
I've requested that this question be closed as follows:

Accepted answer: 0 points for semltd's comment #a39957034

for the following reason:

I have managed to resolve my problem using this procedure and removed all lingeringobjects
0
 

Author Comment

by:semltd
Comment Utility
Hello Mahesh,

after a while, I tried to remove the partitions from NTDSUTIL.
partition management: delete nc DC=DomainDnsZones,DC=geri\0ADEL:bb7cc7ce-96f6-4a98-888c-ed139937e2ed,DC=sem,DC=com

partition management: delete nc DC=geri\0ADEL:bb7cc7ce-96f6-4a98-888c-ed139937e2ed,DC=sem,DC=com

Thank you for your assistance
0

Featured Post

Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

Join & Write a Comment

This is a little timesaver I have been using for setting up Microsoft Small Business Server (SBS) in the simplest possible way. It may not be appropriate for every customer. However, when you get a situation where the person who owns the server is i…
Know what services you can and cannot, should and should not combine on your server.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now